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We investigate quantum state discrimination with confidentiality. N observers share a given 
quantum state belonging to a finite set of known states. The observers want to determine the state 
as accurately as possible and send a discrimination result to a receiver. However, the observers are 
not allowed to get any information about which state was given. Af — 1 or fewer observers might 
try to steal the information, but if N observers coexist, the honest ones will keep the dishonest 
ones from doing anything wrong. Assume that the state set has a certain symmetry, or more 
precisely, is Abelian geometrically uniform (AGU). We propose a protocol that realizes any optimal 
inconclusive measurement, which is a generalized version of a minimum-error measurement and 
an optimal unambiguous measurement, for any AGU state set and ensures that any combined 
state of A — 1 or fewer observers has absolutely no information about the given state. Our protocol 
provides a method of performing a quantum measurement securely, which could be useful in quantum 
information applications. 


I. INTRODUCTION 

Suppose that a sender wants to send a classical mes¬ 
sage to a receiver in the harsh environment, such as deep 
space, but they cannot communicate directly. Thus, the 
sender sends the message to a third party, called an ob¬ 
server, and the observer sends it to the receiver. Consider 
that the observer receives a quantum state pm belong¬ 
ing to a set of known quantum states, po: Pi; • • ■ ; Pm-i, 
which are mutually non-orthogonal. The observer per¬ 
forms a quantum measurement on pm and sends its result 
to the receiver using classical communication. However, 
the message is highly private and/or sensitive (e.g., a 
classified message), and so the observer is not allowed to 
get any information about m. What can the observer 
do to send as precise information about m as possible to 
the receiver while ensuring that the observer obtains no 
information? 

We will show that it is possible to do this when two 
or more observers exist and at least one of them is hon¬ 
est. For simplicity, consider that there are two observers, 
Alice and Bob, and they receive the state pm- We as¬ 
sume that Alice or Bob might try to steal the informa¬ 
tion about m by illegal means, but if they coexist, the 
honest one will keep the dishonest one from doing any¬ 
thing wrong. We propose a protocol where they tells a 
discrimination result to the receiver, Charlie, while en¬ 
suring that absolutely no information is leaked to Alice 
or Bob. Let us explain our protocol using Fig. 1. Alice 
and Bob first transform a given state pm into p'^ as a 
preprocessing step, where p'^ is a (generally entangled) 
state of their composite system. In this step, they cannot 
perform a wrong or evil action since they coexist. They 
next independently measure their individual systems. In 
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FIG. 1. Data flow for a bipartite secure measurement. 

this step, a dishonest observer may try to extract infor¬ 
mation about m. They tell their outcomes to Charlie via 
classical communication. This classical communication 
is encrypted to ensure that neither Alice nor Bob learns 
the classical data that the other one transmits. Charlie 
finally determines m from their outcomes. We refer to 
such a measurement as a bipartite secure measurement if 
neither Alice nor Bob obtains any information about m 
even if they act dishonestly in their individual measure¬ 
ments. 

As is well known, non-orthogonal states cannot be per¬ 
fectly distinguished; thus, we want to find a measurement 
that performs best in a certain strategy. In one strat¬ 
egy, a measurement that maximizes the average correct 
probability [1-3], denoted by a minimum-error measure¬ 
ment, has been investigated [4-8]. In another strategy, a 
measurement that achieves unambiguous, i.e., error-free, 
discrimination with the minimum average failure proba¬ 
bility [9-11], denoted by an optimal unambiguous mea¬ 
surement, has also been studied [12-15]. Recently, as a 
more general measurement, a measurement that maxi¬ 
mizes the average correct probability with a fixed aver¬ 
age failure probability, which we refer to as an optimal 
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inconclusive measurement (OIM), has been investigated 
[16, 17]. Minimum-error measurements and optimal un¬ 
ambiguous measurements can be interpreted as special 
cases of OIMs. 

Remarkably, we show that any OIM, with any average 
failure probability, for the state set {pm} can be real¬ 
ized with a bipartite secure measurement if {pm\ has 
certain symmetry properties, or more precisely, if it is 
a (not necessarily pure) Abelian geometrically uniform 
(AGU) state set [18, 19]. Such a state set is a broad 
class of quantum state sets, including phase shift keyed 
state sets, pulse position modulated state sets, and linear 
codes with binary letter-states [20-22]. We also investi¬ 
gate the multipartite case and derive that a multipartite 
secure measurement can realize any OIM if {pm} is an 
AGU state set. For simplicity, throughout the main body 
of the paper we consider only three linearly independent 
cyclic pure states. In Appendix A, we will extend our 
technique to AGU states. 

Although our scheme and secret sharing might seem 
somewhat similar, they are quite different. In classical se¬ 
cret sharing [23, 24], a classical, i.e., perfectly distinguish¬ 
able, secret is split among several parties. In addition, a 
method for sharing an arbitrary unknown quantum state 
has been proposed [25], which provides a quantum ver¬ 
sion of secret sharing. In such schemes, the parties share 
a classical or quantum state, which can be perfectly re¬ 
constructed when a sufficient number of parties cooper¬ 
ate. In contrast, in a bipartite secure measurement, the 
observers share a classical message encoded in quantum 
states that are not perfectly distinguishable, i.e., a given 
quantum state cannot be perfectly reconstructed from 
the measurement outcome. Moreover, in our scenario, 
the observers cannot communicate with each other after 
preprocessing. Our scheme provides a method for opti¬ 
mally discriminating between quantum states with con¬ 
fidentiality using the basic idea of secret sharing, though 
our technique is drastically different from that of secret 
sharing. Note that combining quantum cryptography 
with classical secret sharing to protect against eavesdrop¬ 
ping has also been proposed [26]. 


II. FORMULATION 

Let us consider discrimination between M quantum 
states represented by density operators pm (w £ Im) 
with prior probabilities where lfc = {0,l,---,fc—1}. 
Pm is positive semidefinite and has unit trace. In this 
paper, we assume equal probabilities = I/Af for any 
m £ Im- If each pm is rank one, in which case pm can 
be expressed as pm = |'0m) (V’ml for any m £ Im, then 
4' = {pm ■ m £ Im} (or 4'pure = {\i’m) ■ rn £ Im}) is 
referred to as a pure state set. Moreover, if {\tpm) ■ m £ 
Im} are linearly independent, then (or ^/pure) is called 
a linearly independent pure state set. 

Let H be the space spanned by {pm '■ 'm £ Im}- Also, 
let Ijc be the identity operator on a Hilbert space JC. 


If there exists a unitary operator V on % such that 
= 1-H and Pm = U™poU“™ for any m £ Im, 
then 'k is referred to as a cyclic state set. In particu¬ 
lar, if the pure state set dtpure is cyclic, then there ex¬ 
ists a unitary operator V on H such that = lu 
and |'0m) = U"* IV'o) for any m £ Im (when we choose 
proper global phases). Gyclic states are special cases of 
AGU states. We will give the definition of AGU states 
in Appendix A 2. 

A quantum measurement that may return an incon¬ 
clusive answer can be described by a positive operator¬ 
valued measure (POVM) with M-l-1 detection operators, 
n = {Hm ■ rn £ Im}, where is the set formed by 
adding element ‘?' to the set Im- The detection opera¬ 
tor lim with m £ Im corresponds to identification of the 
state Pm, while H? corresponds to the inconclusive an¬ 
swer. An OIM is a measurement maximizing the average 
correct probability under the constraint that the average 
failure probability is p (0 < p < 1) [16, 17, 27]; i.e., an 
OIM is an optimal solution of the following problem: 

maximize E Tr(p 

m n™) 

subject to ^mTr(pmn?) = p. 

m^XM 

A minimum error measurement is a special case of an 
OIM, which satisfies p = 0. In this case, we can assume 
without loss of generality that H has M detection oper¬ 
ators, i.e., n = {Hm : rn £ Im}, since Tr(pmn7) = 0 
holds for any m £ Im - 

To realize an A^-partite secure measurement with N > 
2, we consider the procedure performed by N observers 
and one receiver: 

Step 1) The observers first perform an operation to¬ 
gether to transform a given state pm into a state 
of their composite system, denoted by p'^. 

Step 2) Each observer independently performs a mea¬ 
surement on the state of his/her individual sub¬ 
system. 

Step 3) Each observer sends his/her outcome to the re¬ 
ceiver via private classical communication. 

Step 4) The receiver determines m from the observers’ 
outcomes. 

Assume that in Step 1, which we call the preprocessing 
step, the observers cannot perform a wrong or evil ac¬ 
tion. In Step 2, dishonest observers may try to extract 
information about m with wrong measurements. More¬ 
over, if A > 3, then A — 1 or fewer dishonest observers 
may collaborate to get the information. We refer to a 
measurement according to this procedure as an A-partite 
secure measurement if any combined state of iV — 1 or 
fewer observers has absolutely no information about m, 
or, equivalently, if any A — 1 or fewer dishonest observers 
get absolutely no information about m. 
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III. REALIZING A MINIMUM-ERROR 
MEASUREMENT 

Let us begin by considering a minimum-error measure¬ 
ment, and later extend it to an OIM. 

Theorem 1 A minimum-error measurement for three 
linearly independent cyclic pure states can be realized 
with a bipartite secure measurement. 

Proof Assume that 'I'pure = {|'0m) : m G I 3 } is a three 
linearly independent pure state set. Also, assume that 
'Impure is cyclic; i.e., there exists a unitary operator V 
on H such that and |V'm) = |^/>o) for any 

m G I3. Let : TO G I 3 } be a POVM rep¬ 
resenting a minimum-error measurement on "H. is 

always projective, and rank = 1 holds [28], which 
means that is expressed by = with 

an orthonormal basis (ONB) {[tt™^) : to G I 3 } in H. 
Moreover, is cyclic, i.e., [tt^^) = ko*^) holds for 

any to G I 3 [4]. 

We can see that a necessary and sufficient condition 
for a bipartite secure measurement is that the candidate 
states after preprocessing, {p'^ : m G I3}, satisfy 

Tr^ p' = Tr^ Trs p' = Trs pj., ( 2 ) 

for any j,k G I 3 , where Tr^ and Tr^, respectively, rep¬ 
resent the partial traces over Alice’s and Bob’s systems, 
which implies that whether a given procedure is a bi¬ 
partite secure measurement is determined only by the 
preprocessing. Indeed, suppose by contradiction that 
Tr^ p' ^ Ti'a p'j, holds for certain j,k G I 3 ; then, there 
exists Bob’s measurement that gives some information 
to distinguish p' and p'^,. It follows that, in order to ob¬ 
tain a bipartite secure measurement that can realize the 
minimum-error discrimination, we must consider a mea¬ 
surement such that neither Alice nor Bob knows any in¬ 
formation about the outcome obtained by Charlie. This 
means that Alice’s measurement outcome must be inde¬ 
pendent of Charlie’s outcome, and so must that of Bob. 
To realize this, let us consider preprocessing that trans¬ 
forms corresponding to Charlie’s outcome, into 

krn) such that Tr^ km) (Pm| and Tr^ km) (Pm| are in¬ 
dependent of TO. To be concrete, let 

1 2 

km) = —7= kfc) \bmQk) , (3) 

k=0 

where 0 denotes the subtraction modulo 3, and {jam) : 
TO G I 3 } and {| 6 m) : w G 2 ^ 3 } are ONBs in Alice’s 
and Bob’s spaces, respectively. Such preprocessing can 
be realized with the completely positive trace-preserving 

(CPTP) map (f denotes the con¬ 
jugate transpose), where k*^) (4'’I- This 

preprocessing turns the given state jkm) into |kk) = 
A(®)km). Now, we show that pk = Ikk) (kkl satisfies 
Eq. (2). Let Xk = (4**^ko); then, since {km4 and 
{km)} are cyclic, ( 4 ''Vm) = Xfcem holds, which gives 


kk) = ELoX/cQm kfc)- Thus, from Eq. (3), we have 

TrAPk= E ^^^^Y^lke;)(ked 

j,k,l—0 

= E ^^\bj'ei'){bk'ei'\, (4) 

j' ,l'—0 

where j' = j Q m, k' = k Q m, and V = I Q m. This 
equation means that Tr^ pk is independent of m. In 
the same way, we can easily derive that Tr^ pk is also 
independent of to. Therefore, Eq. (2) holds. 

The last thing we have to show is that the minimum- 
error discrimination can be realized with only the local 
operations to the state km)- Now, we consider the fol¬ 
lowing procedure: Alice and Bob independently perform 
measurements for kk) fo the ONBs {|a„)} and (jk)}, 
and then send their outcomes j and k, corresponding to 
\aj) and \bk), to Charlie, respectively. Charlie records 
his result as j 0 k, where 0 is the addition modulo 3. 
It follows that this procedure can be represented by the 
POVM $(®) = : TO G I 3 } with 

2 

4*4 ~ ^ kfe) (®fc| ® \bmQk) (^m0fe| ■ 

k=0 

We obtain 

2 22 

(kkkkkk) = E ^“'=1 (kefclE^*e™ kt) 

k=0 t=o 

= IXnem|" = (km|nk)km), (5) 

which indicates that this procedure can realize the 
minimum-error discrimination. ■ 


IV. REALIZING AN OPTIMAL 
INCONCLUSIVE MEASUREMENT (OIM) 

We extend the argument of Sec. Ill to an OIM in the 
following theorem. 

Theorem 2 An OIM with any average failure probabil¬ 
ity for three linearly independent cyclic pure states can 
be realized with a bipartite secure measurement. 

Proof Let d>pure = (km) : w G I 3 } be a set of three 
linearly independent cyclic pure states. Also, let 11 = 
{Hm ■ rn G be an OIM on H for 'kpure- 14^ (to G 
I 3 ) is rank one and thus can be expressed in the form 
Llm = km)(7>'m| [27]. In contrast, II? is generally not 
rank one. Assume without loss of generality that II is 
cyclic, i.e., (tt^) = V'" (tto) holds [27]. 

In the proof of Theorem 1, to realize a minimum-error 
measurement with a bipartite secure measurement, we 
exploited the fact that the POVM 11^®^ is projective and 
cyclic. We want to apply a similar approach to an OIM; 
however, II is generally non-projective. We consider, in¬ 
stead of n, an OIM that is projective and cyclic. Let 






4 


Hex be a six-dimensional Hilbert space including H, and 
Q = {Om : m £ l|} be a projective measurement on Hex 
expressed as 

, mela, 

m—0 

where : m G € I 2 } is an ONB in Hex- Let 

P be the orthogonal projection operator from Hex to 
H. Assume that H is an OIM for 4'pure, which satis¬ 
fies PflmP^ = n,„ for any m G l|, and that for each 
s G I 2 , {P |wm^) : m G I 3 } is cyclic, i.e., we have 

= mGl3. 

As will be described later, these assumptions hold if we 
properly choose an ONB {|wm^)}- Now, under these as¬ 
sumptions, we show that a bipartite secure measurement 
can realize an OIM for 4'pure- 

First, we show preprocessing in which a bipartite se¬ 
cure measurement is possible, i.e., Eq. (2) holds. Con¬ 
sider that Alice and Bob perform the preprocessing rep¬ 
resented by the CPTP map C{X) = AXA^, where 


s —0 m—0 

1 2 


(s)| 


hm ) = SGl2,mGl3- 

VO 


o is the addition modulo 2, and {|am^) : m G I 3 , s G I 2 } 
and : rn G Is^s G I 2 } are ONBs in Alice’s and 

Bob’s systems. Since {H|a;m^)} and {|'0m)} are cyclic, 
= (WfcQmlV’o) holds. Thus, we can verify that 
the state after preprocessing, |' 0 ^) = A\'ipm), satisfies 
Eq. (2) in the same way as in Eq. (4). 

Next, we show that an OIM can be realized with the 
following procedure: Alice and Bob independently per¬ 
form the measurements for the state IV’m) ia the ONBs 
{|am^)} and {| 6 m^)} and send their outcomes (denoted 
by and to Charlie, respectively. Charlie 

records his result as j 0 fc if q = s and “failure” other¬ 
wise. This procedure can be represented by the POVM 
‘b = {‘hm : TO G I 3 } with 

= E E ® > w e X3, 

g—0 k—0 

^? = E E 

q—0 m,k=0 


In a similar way to Eq. (5), we can easily verify that 
{ip'rri\^k\ip'm) = {'>Pm\^k\ipm)■ Therefore, this procedure 
realizes an OIM. 

Finally, we have to show that an ONB {|wm^)} exists 
such that O is an OIM for d^pure and {P |wm^)} is cyclic. 


Let {\4>m) : TO G X 3 } be an ONB in H such that the 
Schatten decomposition of H? is represented by H? = 

J2l=o^k\4>k) {4>k\- We choose an ONB {\(l)m) : to G 
I 3 , s G I 2 } in Hex such that 

p|</.W) = yr^i0„,), 

P\^^rL^) = ^/^\<l^m). ( 6 ) 

This implies that the one-dimensional subspace 
span(|(()m)) of H is associated with the two di¬ 
mensional subspace span(|^m^ ),\4’m^)) of Hex- Let 
Fs = Ylk=o\4>l^'^) {4‘k\, which is an isometric mapping 
fromH tospan(|(/)[,®^) , , |(() 2 *^)), and {\vm) : to G I 3 } 

be an ONB in H satisfying K\vra) = Iti"™), where 
A = (1^ — (such an ONB always exists [29]). We 

choose as = Fq \vm) and = Fi 

where is a detection vector of the minimum-error 

measurement We show that {|a;m^)} is an ONB in 

Hex that we sought. From Eq. (6) and the definition of 

1 /2 

Fg, we can easily verify that FFq = A and PFi = H,,' 
hold. The former equation yields 

P = FFo Wm) = A |^/„,) = \tt^) , (7) 

which indicates FOmPf = H^. Also, we have 

FOvPt = p( Ft 

\ m^O / 

2 

= l-H - E ^ 

m—0 

which follows from FPt = 1-j^. Thus, O, as well as H, is 
an OIM. Moreover, {F|a;m^)} is cyclic for each s G I 2 ', 
indeed, from Eq. (7), 

F |a;W) = K) = P-Itto) = P™F 
1 /2 

and since V commutes with H,,' , 

F |a;L')) = = P-F k^). 

This completes the proof. ■ 

The proposed protocol for realizing an OIM is summa¬ 
rized as follows: Alice and Bob first transform a given 
state km) into \tpm) by the preprocessing £. They next 
perform measurements in the ONBs {km^)} and {km^)}, 
and send their outcomes to Charlie. The average failure 
probability can be controlled by properly choosing the 
ONB Ikm^)}. In this discussion, we consider the pre¬ 
processing C that transforms km) into a generally en¬ 
tangled state. We can also show that a bipartite secure 
measurement that realizes an OIM exists such that pk is 
always separable (see Appendix A 3 b). 
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V. MULTIPARTITE CASE 

We consider extending this scenario to the multipar¬ 
tite case. The more observers there are, the more diffi¬ 
cult it can be for dishonest observer to steal the infor¬ 
mation about m. Thus, it may be desirable to increase 
the number of observers if the information must be kept 
highly confidential. In the multipartite scenario, there 
are TV > 3 observers and one receiver. Let us consider the 
following protocol: N observers hrst share a given state 
by preprocessing. After that, they independently per¬ 
form measurements and send their results to the receiver. 
We refer to the measurement as an iV-partite secure mea¬ 
surement if any combined state of — 1 or fewer ob¬ 
servers has absolutely no information about which state 
was given. Here, we describe the case of = 3 for three 
linearly independent cyclic pure states. As a prepro¬ 
cessing step, Alice, Bob, and Charlie transform pm into 
p'^ = C{pm) with the CPTP map Cn{X) = 
where 

1 2 

s—0 m—0 

i: E i4''’) kSsb ■ 

(3'i,g2—0 ki,k2—0 

{|cm^) : m € l 3 ,s € I 2 } is an ONE in Charlie’s sys¬ 
tem. They independently perform measurements in the 
ONBs {|am^)}, {l&mEi {|cm^)}, and send their out¬ 
comes (denoted by and |c[^^)) to Dave. Dave 

records his result asj©fc©T ifgosor = 0 and “fail¬ 
ure” otherwise. In a similar way to the bipartite case, we 
can see that using this procedure, any OIM can be real¬ 
ized with a tripartite secure measurement. We can show 
that if possible candidate states are AGU, then any OIM 
can be realized with an A-partite secure measurement 
for any N > 3 (proof in Appendix A 4). 


VI. CONCLUSION 

In summary, we have proposed a quantum measure¬ 
ment scheme, called an A-partite secure measurement, 
that enables confidential communication of classical mes¬ 
sages via quantum channel. In our bipartite protocol, 
Alice and Bob first share a quantum state obtained with 
preprocessing. They next independently perform the 
measurements, in which neither Alice nor Bob gets any 
information about which state was given even if one does 
anything wrong, and send their results to Charlie. We 
stated that an OIM for any AGU state set can be realized 
with an A-partite secure measurement. 
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Appendix A: Extending to Abelian geometrically 
nniform (AGU) states 

In this section, we prove that any OIM for AGU states 
can be realized with an A-partite secure measurement 
for any A > 2. 


1. Outline 

First, in Subsec. A 2, we provide definitions and a 
lemma. Next, in Subsec. A3, we consider a bipartite 
secure measurement. We show that any OIM for AGU 
states can be realized with a bipartite secure measure¬ 
ment (Theorem 4). We also show that there exists such 
a bipartite secure measurement in which a given state 
is transformed into a separable state in a preprocessing 
step. Finally, in Subsec. A 4, we extend Theorem 4 to 
the multipartite case (Theorem 5). 


2. Preliminaries 

We consider a set of M quantum states 4' = {pm ■ m £ 
Q}, where Q is an Abelian group with M elements. Let 
e be the identity element of Q. Assume that there exists 
a set of M operators, {Um '■ rn € G}, in which Um is a 
unitary or anti-unitary operator on 'H satisfying 

Ue = 1-H, 

UmUk — Ujjioki 'kkl-, k £ G■) (-^1) 

and 

UmPkUrn ~ Praoki k £ G^ (-^^) 

where m o k is the multiplication of m and fc, and is 
the operator satisfying Uj^Um = UmU}^ = 1-h- Note that 
if Um is an anti-unitary operator, then so is C/^. Such a 
state set with equal prior probabilities is called an AGU 
state set [18-20]. In particular, if G is cyclic, then 4' is 
referred to as a cyclic state set. 

A quantum measurement for 41 that may return an 
inconclusive answer can be described by a POVM H = 
{Am : m £ G?}-, where G"? is the set (which is not a 
group) formed by adding element “?' to (/. The detection 
operator H^ with m £ G corresponds to identification of 
the state prm while H? corresponds to the inconclusive 
answer. 

For a given set of unitary or anti-unitary operators 
{Um : TO £ (/} on "H satisfying Fq. (Al), we say a set of 
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vectors {|am) : m £ t/} of "H is AGU if 

\amok) = Um\ak), m,k&Q. (A3) 

Let R = rank which is independent of m when tk is 
AGU. It follows that there exist vectors {\'tjjrn,r) ■ "m £ 
G,r GIr} such that 

Pm ~ 'y ^ 7 ‘kTl G Q■, 

reiR 

\i’mok,r) = Um\i’k,r), m,kGQ,rGlR, (A4) 

i.e., {\’4’m,r) '■ m G G} \s AGU for any r G Xr. In¬ 
deed, if we choose {\'4’e,r) '■ i' G Ir} such that Pe = 
J2r&XR\'^e,r) {4’e,r\ and let \4’m,r) = Um\i’e,r), then 

Eq. (A4) holds. 

The following lemma shows that any OIM for AGU 
states can be expressed as a projection valued measure 
(PVM) with certain symmetries (proof in Appendix B). 
Lemma 3 We consider a PVM U = {Gt^ '■ m G G?} 
on a 2Mi?-dimensional Hilbert space (denoted by Hex) 
satisfying Hex X H. Assume that Glm is expressed as 

Glm=Y^ I 7 m G G , 

r€lR 

= E E (A5) 

mGS tGIr 


where '■ s Gl 2 ,m G G,r G Ir} is an ONB in Hex- 

is) 

For any p with 0 < p < I, there exists an ONB {jwm.r)} 
such that 


P r) = PrnP 7 k,m G G, S G l 2 ,r G Xr 


H) 


(A 6 ) 


holds (i.e., {P Iwm^r) : m £ C/} is AGU for any s G X 2 
and r € Xr) and Gl is an OIM, with the average failure 
probability of p, for 


3. Bipartite secure measurement for AGU states 


a. Realization of an OIM 


(GPTP) map C{X) = AXA\ where 

^ = E E E : 

9 ^X 2 k^Q v^Xr 


= ;/= E E Ib^Tkp 7 (A7) 

^ sei2 teS 


m is the inverse element of m, and o is the addition 
modulo 2. {|amlr) : s G X 2 ,m G G,r G Xr} and 
{|6E) : s G X 2 ,m G GjT G Xr} are, respectively, ONBs 
in Alice’s and Bob’s systems, each of which is 2MR- 
dimensional. Let IV’m r) = A\'ipTn,r)- This map trans¬ 
forms \4’m,r) into \4’'m,r)i ^-nd thus p'^ = C{pm) is ex¬ 
pressed by 


P'm = ^ Wm,r) {i’mA ■ 

r€lR 

We show that a bipartite secure measurement can be 
realized with the preprocessing £ and that an OIM can 
be realized with measurements, independently performed 
by Alice and Bob, for the state p'^. 

First, we show that a bipartite secure measurement 
can be realized. A necessary and sufficient condition for 
a bipartite secure measurement is that for any j,k G G, 
{p'^ : m G G} satisfies 

Ti'a p'j = Tr^ pfe, Trs p' = Trs p}, (A9) 

where Tr^j and Trg are the partial traces over Alice’s 
and Bob’s systems, respectively. Thus, it suffices to show 
Eq. (A9). Let Xkly = {‘-^k}.\i’e,r') /V2M; then, we have 

= i^^lkJP^ULUmli^ey) 

^^rnok,r \^ey) = (AlO) 

where the first line follows from Eqs. (A4) and (A 6 ) (i.e., 

both {\4’m,r) ■ rn G G} and {P ■ m G G} are AGU). 
Thus, from Eq. (A7), we obtain 

= A l-lpruy) = E E E l^r) 

I3el2 ksG t^Ir 

= VM E E E \VmlkGr) > (AH) 

q&I-i kyQ reZR 


In Theorem 2, we showed that any OIM for three lin¬ 
early independent cyclic pure states can be realized with 
a bipartite secure measurement. Here, we extend this 
result as follows: 

Theorem 4 An OIM, with any average failure probabil¬ 
ity, for AGU states can be realized with a bipartite secure 
measurement. 

Proof Let us consider an AGU state set = {pm ■ m G 
G}- Also, let fl and {Iwm^r)} be the OIM for and the 
ONB obtained by Lemma 3, respectively. Consider that 
two observers, Alice and Bob, perform the preprocessing 
represented by the completely positive trace-preserving 


where k' = mo k. In contrast, from Eq. (A7), we have 

TrA IVmlk'J iVmh'rl 




.sei2 tgq 


2 A/f z ^ ^ ' tokPr' ' tol\r' ’ 


(A12) 


8^X2 t^Q 


which means that Tr^i Ip^Lyr) independent 

of m. Therefore, from Eq. (All), Tr^ Wmy) {i’'my\ 
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is independent of m, and thus so is Tr^ = 

IV'm.r') I• Similarly, from 


Trs 


„(«) 

•mol' 




EEi 

.sei2 tee 


d<?os) 

^k'ot,r 


)i4: 


7 '^ )K' 

tom.r' ' t 


(liOs) I 

ot,r I 




(s) I 
tom.r' 


1 


EE 

5 ^X 2 


I ( 90 ^*) \ /„(“Ot*)| 
'^k'ot,rl \^Z'ot,rl 


(A13) 


we can easily derive that Tr^ p'^ is also independent of 
m. Therefore, Eq. (A9) holds. 

Next, we show that an OIM can be realized with only 
the local operations to the state p'^. We consider the fol¬ 
lowing procedure: Alice and Bob independently perform 
measurements in the ONBs {|am^r)} and {l^^m^r)}, respec¬ 
tively, and send their outcomes, denoted by and 

l^z to the receiver, Charlie. Note that from Eq. (A7), 
r = r' always holds. Charlie records his result as t o /, 
which corresponds to \tptoi), if s = g and “failure” oth¬ 
erwise. It follows that this procedure can be represented 
by the POVM B' = {B^ : m £ G?} with 


Bl 


E E E ® \^iok,r) (^iokj 

seX2 tee reiR 


for each k G G and 
B' 


E E E 

sel2 t,kGQ tGIr 




®ld><Cil-(A15) 


From Eqs. (A7) and (A14), for any q,s G I 2 , k,t,l G G, 
and r' G Ir., we have 

ivpjl^klviy) = Sq,o6s,o5t,kSl,k5r.r', (A16) 

where Sa^ is the Kronecker delta. Thus, from Eq. (All), 
for any k,m G G and r' G Ir, we have 

tGIr 

— {}Pm,r'\Gt‘k\'^m,r’^ t (-^^7) 

where the second line follows from Eqs. (A5) and (AlO). 
This gives 

Tr(p:„Bl.)= 

r'SlR 

— ^ ^ {'4^771,r'\Gi‘k\'4^m,r') — 
r'GXii 

Tr(p:„B() = 1 - ^ Tr(p:„B;) 
fcee 

= 1 - ^ Tr(pmBfc) = Ti{pmGl7), (A18) 
fcee 

which indicates that the average correct and failure prob¬ 
abilities of B' for dt' are identical to those of B for 
respectively. Therefore, this procedure realizes an OIM. 


b. Preprocessing for returning a separable state 


Bere, we show that an OIM can be realized with a bi¬ 
partite secure measurement even if Alice and Bob use the 
following CPTP map, instead of C, in the preprocessing 
step: 


£.ep(A) = E E E 

s€X2 k£Q tGXr 


(s)t 

r ’ 


= 


1 


i«£)EEiCE-Si-(ai9) 


9ei2 jeQ 


is a CPTP map since 


E E E 

8 ^X 2 k^G t^Xr 

1 


= ^ E E Ei-S)(-?' 


2M 

s,qGl2 j,ke0 tGIr 

= E E E = IWe: 

<?Gl2 j&G reiR 


(A20) 


p'^ = CsepipTTi) is a mixed state, even if pm is a pure state, 
but is always a separable state; indeed, from Eq. (A19), 
we have 


i(s)t 

;,r ’ 


= E E E ^k^p^^k, 

8 ^X 2 k^G rGXR 

I?) ,,( 9 ')* 


where 


= V V V A 

s,g,g'Gl2 k,j,j'GG r.tGlj? 

-i 4 :>) (All <€"!•' 

= E E E i“A) <“l!li 

SGI2 k,j,j'GG tGIr 

® E iT'mkr.t) (7Sfc,r-,tl > 

tGiB 


I 'm,k,rX^ / ^ ^ Amo7,r.t \ L^r^j ' 


q^X 2 j^G 


(A21) 


(A22) 


We show that an OIM can be realized with a bipartite 
secure measurement using £sep- 

First, we show that a bipartite secure measurement 
can be realized, i.e., Eq. (A9) holds. We have 

Tr„ o' = 

Hm / j / j / _j Amoj,r,t'^mQj' ,r,t 

s,q,q'^X 2 kJJ'^G r,t^XR 


koj,r' ' koj',r' 


= E E E xi%xiir!t 

s,q,q'£X2 k.,l,l'£G r,t£XR 

Trii (>;„ = E E E I Aii.r.i 

S,gel 2 fc.jgg r.telK 

= E E E iAt.i‘i4:l)(Ali.(A23) 

s,gGX2 k.i^G r,t£XR 


../lAlxAli 





where n = mok, l = moj, and l' = rfioj'. Thus, Tr^ p'^ 
and Trs p'm are independent of m, i.e., Eq. (A9) holds. 

Next, we show that an OIM can be realized with the 
procedure that is the same as in the proof of Theorem 4, 
except for the preprocessing step. The procedure after 
preprocessing is represented by the POVM 11' satisfying 
Eqs. (A14) and (A15). From Eqs. (A14) and (A21), we 
have 


i.e., t G Gk, always holds from Eq. (A26). This implies 
that for a fixed k G G, the elements of G^~^, t, are 
in one-to-one correspondence with the elements of Gk, t. 
Thus, for any i/ G In, \'n^k'r) rewritten as 

i^i?) = ^ E E f 0 

S^Sq/ 


Tr(p;,n'fc) = 2M ^ |x^),^j2^Tr(p^f2fc),(A24) 
and thus Eq. (A18) holds. Therefore, 11' is an OIM for 

{p'm — •^sep(pm)}. 


4. Multipartite secure measurement for AGU 
states 

In this section, we extend Theorem 4 to a multipartite 
secure measurement. 

Theorem 5 For any N with A^ > 2, an OIM, with any 
average failure probability, for AGU states can be real¬ 
ized with an A-partite secure measurement. 

Proof In preparation, let us represent the preprocessing 
performed by N observers as the CPTP map C. Consider 
an AGU state set 41 = {pm '■ m G G}- Let O and {|wm^r)} 
be the OIM for 41 and the ONB obtained by Lemma 3, 
respectively. Also, let Sq be the entire set of a collection 
of N elements of I 2 , denoted by s = (sq, si, • • • , sn-i), 
satisfying sq o si o • • • o sn-i = q, and Gk be the en¬ 
tire set of a collection of N elements of G, denoted by 
t = {to, ti,--- , tN-i), satisfying tg o o • • • o tN-i = k. 
Assume that C can be expressed \yy C{X) = AXA^ with 

^ = E E E ’ 

qeX2 keg rex^ 

I^S) = ^ E E f 0 ’ (^ 25 ) 

s€Sq tGQk \nGXjv / 

and C = . For each n G In, : 

s G 12 , 1 X 1 G G,r G Ir} denotes an ONB in the 2 MR- 
dimensional system of the n-th observer. Here, we 
rewrite \pl?l) of Eq. (A25) in yet another form. Let G^~^ 
be the entire set of a collection of A — 1 elements of G- 
For each n,v G In, t = (tq,--- ,tn-2) G G^~^, and 
k G G, let k) G G be 

tn,u{x, k) = Tn —1 O kn^u O Tn, (A26) 

where kn,i/ = k li n = v and kn^v = e otherwise, and 
T_i = TN-i = e. For example, in the case of A = 
3 and v = I, to,!/(ufc) = o /c o n, 

and t2,v{x,k) = iq. Here, for a fixed v G In, let t = 
(to,iy(T, fc), • • • In- 1,v{T,k)) for a given r G G^~^ and 
k G G', then. 


to O • • • O tN-l = to,!v(U k)o ■ ■■ O tN-l.u{T, k) 


= k. 


(A27) 


We can prove this theorem in a similar way as Theo¬ 
rem 4. We first show that an A-partite secure measure¬ 
ment can be realized with the preprocessing C and next 
show that an OIM can be realized with measurements, 
independently performed by N observers, for the state 
Pm ~ I'{Pm)- 

First, we show that an A^-partite secure measurement 
can be realized. It suffices to show that for any v G In, 
: mG G} satisfies 

Tri, p' = Tr,, p^, (A29) 

where Tr^, is the partial trace over the system of the i/-th 
observer. Let Xkl,r' = {^k}-\'^e,r') /C', then we have 


= {^^lk,r\P^UlUm\lPe,r>) 

~ = tAXrJok,r,r'' (A30) 

Equations (A25) and (A30) yield 

l^m,r') = ^ \lpm,r') 

= E E E Xmlk,T,r' Ivifr) 

qeX2 keg reXu 

= \'^m.k',r) > (A31) 

qeX 2 k'eg reXR 

where k' = mok. In contrast, Eq. (A28) yields 


\'lmok',r/ Vlmol'. 


= _Tr 


E E ( ^ \ptr,"u{T,mok’),r) 


.seSg regi^-i \neXff 


I (®n) 


xE E 

s'^Su \n^Xp^ 

^ E E E e(T,T',mofc',moZ') 


(J 2 


seSq s'gSu T,T'egi^-i 

/ 


tiGXn 

\ 


^t^t7i,i^iT,mok'),r^ {ptn,g{T',mol'),r{ 


(A32) 


where 


e(r, r', mo k',mo I') 


1, U,u{T,k') =U^, 2 {t',P), 

0, otherwise. 

(A33) 


We should note that k') = tu,v{x’, I') in Eq. (A33) 

is equivalent to mok') = mol'), since G is 
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Abelian. Since tn,v{T,mo k') is independent of m when¬ 
ever n ^ V, which follows from Eq. (A26), and e(T,T',mo 
k',mol') is also independent of m, the right-hand side of 
the last equality of Eq. (A32) is independent of m. Thus, 
from Eq. (A31), Tr^ \ip!^ ^,) j,,\ is independent of m. 

Therefore, Tr,. p'^ = Tr^ IV'm.r') (V'm.r'I is also 

independent of m, which means that Eq. (A29) holds for 
any v G In. 

Next, we show that an OIM can be realized with mea¬ 
surements, independently performed by N observers, for 
the state We consider the following procedure: For 
each n G In, the n-th observer independently performs 
the measurement in the ONB '■ Sn G I 2 , tn G 

G,rn G Ir} and sends his/her outcome (denoted by 
receiver (note that from Eq. (A25), ro = 
ri = • • • = tn-i always holds). Let k = tQotio- ■ -otjv-i- 
The receiver records his/her result as k, which corre¬ 
sponds to \ipk), if so^siO- • ■<>sn-i = 0 and “failure” oth¬ 
erwise. This procedure can be represented by the POVM 
n' = : m G G?} with 


= E E E f 0 (A34) 

s65o tGIr VriGlN / 

for each k G G and 

= E E E E f <8> idb') . (ass) 

sGSi k^Q t^Qk XtiGXn / 


From Eqs. (A25) and (A34), for any q,s G I 2 , k,t,l G G, 
and r' G Ir, we have 

(EEfchi.r') = ^qfihp5t,k5l,k5r,r', (A36) 


and thus, from Eq. (A31), for any k,m G G and r' G Ir, 
we have 


{'^'^y\KWmy)=C^ E \X^lk,r,r'\ 

rSlR 


(A37) 


where the second line follows from Eq. (A30). Thus, we 
have 


Tt{p'M= E 

r'GXji 

r'gifl 

Trip'^U',) = 1 - E Tr(p/.n/) 
keg 

= 1 - E Tr(pmf2fc) = Tr(pmf2?), (A38) 

keg 


which indicates that the average correct and failure prob¬ 
abilities of n' for 'L' are identical to those of Gl for 
respectively. Therefore, this procedure realizes an OIM. 


Appendix B: Proof of Lemma 3 
1. Preparations 

Before we provide the proof, we provide definitions and 
facts. Let LI = {!!„ : m G G?} be an OIM on "H, with the 
average failure probability of p, for 'L. From Refs. [19, 
27], we can assume without loss of generality that 

Ilmo/c — UmGi.kUrm 771, k G G, 

n? = UmGliUl, tugG. (B 1 ) 

We can choose proper vectors {\Trm,r) ■ rn G G,7‘ G Ir} 
such that 

Ilm = ^ (Xyn.rl , TU G G, 

reiR 

\77mok,r} — Um iTT/c.r) , 771, k G G- (^^) 

Indeed, if we choose {\T7e,r) '■ r G Ir} such that 
Ilg = X^reXR l^e,r) (x'e,r| and let [tt^ ,.) = |x'e,r); then 

Eq. (B2) holds. Let D = dim T-L and Tfi be an MR- 
dimensional Hilbert space satisfying Tf C C Hex- Tfi 
always exists since D < MR < 2MR holds, and Ri =% 
obviously holds li D = MR. Also, let A = (1^ — H?)^/^; 
then the Schatten decomposition of A can be represented 

by 


A= ^ ^l-\d\ct7d) {M. (B3) 

d^XMR 

where {\4>d) '■ d G Imr} is an ONB in "Hi. Let Rr = 
supp A. Since Rr C R holds, we assume without loss of 
generality that {|/>d) : d G Id} spans the space R, and 
thus, Ad = 1 holds for any d with D < d < MR. P is 
expressed by 


(B4) 

d^Xr) 


Now, we show that there exist two ONBs : tti G 

G,r G Ir} and {|E)r) : m G I/, r G Ir} in Ri such that 

= \'^m,r) , rnGG,r GIr, (B5) 

P\^^lk.r) = UmP\vl}^), 7 n,kGG,rGlR. (B6) 

First, we show an ONB {|?^m|*r)} satisfying Eq. (B5). Let 
[tt/j j.) = A+ \TTra,r) (A+ is the Moore-Penrose inverse of 
A); then from Eq. (B2), we obtain 

E E = A+ ( E n™ ) A+ 

meg reiR \meg ) 

= A+A2A+= (B7) 

Thus, {IRm.r) {'^m,r\ ■ 771 G G,r G Ir} is & POVM On Ra. 
From Naimark’s theorem, there exists an ONB, denoted 
by {kE)}: in Pi such that Pa |?;E) = Wm.r) PO], 
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where P\ is the orthogonal projection operator from "Hi 
to Ha- It follows that, for any m € G and r S In, 

A = A Wm,r) = km.r) , (B8) 

i.e., Eq. (B5) holds. Next, we show an ONB {|nmi*r)} 
satisfying Eq. (B6). Let 11^®) = {Ilm^ : m £ G} he a 
minimum-error measurement on 'H for dt. Let us choose 
Km^r) such that 

reiR 

kmifc.r) = Um K^r) ^ rn,k £ G■ (B9) 

In the same manner as in Eq. (B2), we can always choose 
such iTTm^r). From Naimark’s theorem, there exists an 
ONB, denoted by {|nm.r)}, in 'Hi such that P\v'^^r) = 
iTT^^r). Thus, 

P\^^lk,r) = = Um kg) = UmP kg) , 

(BIO) 

i.e., Eq. (B6) holds. 


Let us consider the PVM O defined by Eq. (A5) with 
this ONB {|a;kg}. We will prove that fl is an OIM, 
with the average failure probability of p, for d' and that 
Eq. (A6) holds. 

3. Proof of O to be an OIM 

Here, we show that fl is an OIM, with the average 
failure probability of p, for dt. From Eqs. (B3), (B4), 
(Bll), and (B12), we have 

ppo=Y. E kk ('/'kkf) (kk 

d^Xo J^Xmr 

= E \/l “ Ikd) (kdl = A, 

d^Xr) 

PFi= Y, y^d kd) (M = (iw - Ak'/' = 

d^Xiy 

(B14) 

From Eqs. (B5), (B12), and (B14), for any m £ G and 
r £ In, we have 

PKV)=AkWk = kr„..), (B15) 

which gives PVlmP^ = him for any m £ G- Also, we have 


2. Derivation of 


Let us remind that Hex is a 2Mi?-dimensional Hilbert 
space satisfying Hex 3 Hi. We choose an ONB {kg) : 
s £l 2 ,d £ Imr} in Hex such that for any d £ Imr, 


j^ikg) = v^T^kd), 

Pikg) = g^kd), (Bll) 

where Pi is the orthogonal projection operator from Hex 
to 'Hi. This implies that the one-dimensional subspace 
span(kd)) of Hi is associated with the two-dimensional 
subspace span(kg), kg)) of Hex- We define |wmg as 

= Ps kmg > s £l 2 ,m£G,r £Ir, 

Ps= S£l 2 . (B 12 ) 

d^XMR 


We can easily verify that (kmg : s £ I 2 , m £ G,r £ In} 
is an ONB in Hex- Indeed, we obtain 


(w. 


(*) ,) = 

m'r'l \ m,r 


,0) 


/ j.f') — dm,m' dr 


(B13) 


where Sa,b is the Kronecker delta, which follows from Fs 
being an isometric mapping, and (wmgwgg,) = 0 holds 
from HqFi =0 . 


pn.pi = p ^ pi 

V meG ) 

= ^ n„ = H,. (BI 6 ) 

meG 

Therefore, hi is an optimal solution of problem (1) as 
well as H, i.e., hi is an OIM, with the average failure 
probability of p, for 41. 


4. Proof of Eq. (A6) 


Here, we show Eq. (A6). From Eqs. (B2) and (B15), 
for any m,k £ G and r £ In, we have 


P kmofe.r) “ kmofc.r) — Um kfc.r) — UmP \^k,r) ' 


(B17) 


Moreover, from Eqs. (B6), (B12), and (B14), for any 
m,k £ G,r £ In, we have 


P kgfc.k = kgfc.k = n^^p kg,,k 

= ny^UmP\vi]l}=Umhiy^\vi]l} 

= UmP\u;[}l), 


(B18) 


1 /2 

where the fourth equality follows since H, commutes 
with Um from Eq. (Bl). Therefore, Eq. (A6) holds. ■ 
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